User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.